OCI Cache IAM Policies

User Permissions

To create or manage a cluster, users require permissions to access to create and manage the required Networking resources in addition to permissions to create and manage OCI Cache resources. The following policy example grants these permissions to the ClusterAdmins group:

Allow group ClusterAdmins to manage redis-family in compartment <YOUR_COMPARTMENT>
Allow group ClusterAdmins to manage virtual-network-family in compartment <YOUR_COMPARTMENT>

You can configure these permissions with more granularity, see Sample Policies.

Resource Types

OCI Cache offers both aggregate and individual resource-types for writing policies.

Aggregate Resource Type

redis-family

Individual Resource Types

redis-clusters
redis-work-requests

You can use the aggregate resource type to write fewer policies. A policy that uses redis-family is the same as a policy that uses separate statements for each of the individual resource types.

Sample Policies

The following policies let the group ClusterAdmins use and manage OCI Cache resources.

• Allows use-only access to VCNs, compartments, and subnets only. For example:

  • Allow group ClusterAdmins to use compartments in tenancy

  • Allow group ClusterAdmins to use vcns in compartment <USER_NETWORK_COMPARTMENT_NAME>

  • Allow group ClusterAdmins to use subnet in compartment <USER_NETWORK_COMPARTMENT_NAME>

  • Allow group ClusterAdmins to use network-security-groups in compartment <USER_NETWORK_COMPARTMENT_NAME>

  • Allow group ClusterAdmins to use vcns in compartment <USER_ENGINEERING_COMPARTMENT_NAME>

  Note
  
  The VCNs are located in the Network compartment, while clusters are in the Engineering compartment.
• Allows use-only access to VNICs in the Engineering compartment. For example:

  Allow group ClusterAdmins to use VNICs in compartment <USER_ENGINEERING_COMPARTMENT_NAME>

• Allows manage permission to create or update private endpoints. For example:

  • Allow group ClusterAdmins to manage redis-family in compartment <USER_ENGINEERING_COMPARTMENT_NAME>

  • Allow group ClusterAdmins to manage redis-work-requests in compartment <USER_ENGINEERING_COMPARTMENT_NAME>

  • Allow group ClusterAdmins to manage vcns in compartment <USER_NETWORK_COMPARTMENT_NAME> where ALL{ ANY
    { request.operation = 'CreatePrivateEndpoint', request.operation = 'UpdatePrivateEndpoint', request.operation ='DeletePrivateEndpoint', request.operation = 'EnableReverseConnection', request.operation = 'ModifyReverseConnection', request.operation = 'DisableReverseConnection' }
    , ANY {request.operation = 'CreateRedisCluster', request.operation = 'DeleteRedisCluster' , request.operation = 'UpdateRedisCluster' } }

• (Optional) Allows traffic on Redis ports. For example:

  Allow group ClusterAdmins to manage security-lists in compartment <USER_NETWORK_COMPARTMENT_NAME> where ANY
  { request.operation = 'CreateRedisCluster', request.operation = 'DeleteRedisCluster' , request.operation = 'UpdateRedisCluster' }

  Note
  
  If the policy isn't provided, you must add security rules and allow TCP traffic for ports, 6379.

The following policy lets the group ClusterUsers use clusters, but restrict other access. For example:

Allow group ClusterUsers to use redis-clusters in compartment <USER_COMPARTMENT>

If you're new to policies, see Getting Started with Policies and Common Policies.

Permissions Required for API Operations

The following table lists the API operations in alphabetical order.